How to match any value in an array to any value in another array?

[dtsao]

I'm trying to do a transaction using an array.  I need to define the transaction by a value in an array.  However, this value could be any value in the array and the value could be in a different array index number in another event.  Is there an easy command for this in Splunk?

[livehybrid]

Hi @dtsao 

I'm afraid you lost me at transaction - I dont think I've seen a good usecase for transaction for a number of years, where stats would be much better. The way I would approach this is to use something like foreach to loop through your array/multival field to set a fixed field with the value you are trying to transaction against. Once you've got this you should be able to do things with stats like | stats range(_time) as timeRange, count, etc BY yourField

If you're able to provide some sample data (redacted if needed) then I'd be happy to create a full query for you.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PickleRick]

I second @richgalloway 's doubts - your description of the problem is confusing 🙂

[richgalloway]

We need more information. Please say more about the problem you are trying to solve.  It would help to see sample data and desired output.